A Browser Pop-up Scam has Taken Over Safari

Back to:

Occasionally, a browser window may pop up with a scam message. Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), trying to force you to download a potentially malicious program, or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus, and your computer has not been infected. This "hijack" is just a JavaScript pop-up, and is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. No website has the capability to scan your computer for viruses.Most of these scammers, if you actually call the number, will ask you to install software giving them remote control over your computer. Do not do this either. This article will outline the solution to dismiss the pop-up. It addresses this specific kind of pop-up. Pop-ups that are ads or pop-ups that can be easily dismissed are usually caused by adware, and are not addressed in this article. This article is mostly for Mac users, but if you are using iOS, skip to here.

On the left, a sample pop-up claiming you must pay a fine to the FBI, and on the right, a sample pop-up claiming that you have a security issue (usually claiming it's a virus). The pop-ups will typically start out with "Suspicious activity detected," and will usually only have an "OK" button

Some of these pop-ups are fairly easy to recognize as scams. For example, you are using Safari and you come across a pop-up that says Chrome is infected. Some even say that you have a Windows security issue, when you are clearly using macOS.

Note that you should try the steps below in sequence, and can stop after you find one that works for you. Also note that if this occurs on your computer, and you see pop-ups like this repeatedly, you may have adware.

What are These Pop-ups?

Either you visited a compromised/hacked website, or a website that displays ads from an ad distribution network that includes the scam website. Once on the scam website, the webpage's script will invoke a JavaScript alert which displays this message. The webpage's script is set up so that the alert will just keep reappearing infinitely whenever you click "OK" on the pop-up. Because this is a browser "alert" and not an actual "window," most pop-up blockers will not stop these scams (you can read about ScamZapper, our Safari extension which is equipped to handle these scams, later on in this article). The good news is, this means that what you encountered is simply a scam webpage and not really malware, in spite of what the pop-up text claims - it's not caused by anything installed on your computer at all. The next sections will explain how to actually navigate away from and close these scam webpages.

If you are Using Safari 9.1 or Later

You can check which version of Safari you have by going to the menu bar and then clicking Safari > About Safari. In Safari 9.1 and later, the pop-up should look similar to this:

Pop-ups in Safari 9.1 or later will not lock up the browser, so you can still access the menu bar and other tabs. In this case, you can just click on the close tab icon next to the tab that is displaying the scam webpage.

If you are Using Safari 6.2.7, 7.1.7, 8.0.7 or later, or Safari 9.0

Back in the Safari window, click on the "OK" button on the pop-up. If the pop-up reappears, you should now see a checkbox that says "Don't show more more alerts from this webpage." Check this box, and click "OK" on the pop-up. It should no longer reappear. Now, close the tab.

First Occurrence of the Pop-up

Subsequent Occurrences of the Pop-up

If the pop-up went away after the first time and took you to a website, close the tab immediately, and if a download begins, move it to the trash from your Downloads folder. Once you get rid of the pop-up, if you are using OS X Mavericks (10.9) or later, we strongly recommend updating to the latest version of Safari, in which browser alert messages do not prevent you from closing the tab.

If you are Unable to Dismiss the pop-up

You might not be able to get rid of the pop-up if you:

Are using an older version of Safari

See a pop-up that does not have the "Don't show more alerts" checkbox

See a pop-up that appears in the form of an authentication or "log in" dialog (learn more below)

Some of these scammers have adapted to the Safari update by adding several extra lines to the pop-up so that the checkbox is below the bottom of the screen. If you see a pop-up like this, or if you have an older version of Safari, please try the steps below to get rid of the pop-up. Once you get rid of the pop-up, we strongly recommend updating Safari, if possible. Users of OS X Mountain Lion (10.8) can update to Safari 8, which makes it somewhat easier to deal with these pop-ups, as discussed in the last section. Users of OS X Mavericks (10.9) or later can update to an even newer version of Safari in which these pop-ups will not lock up the browser at all, as discussed in the first section.

You might also see a pop-up like this:

The scammers started using these authentication dialogs in an effort to bypass the technologies introduced in Safari 9.1 that prevent JavaScript alerts from locking up the browser. They decided to start using authentication prompts instead, as they still lock up Safari and require acknowledgement before you can take any other action in the browser. Just like the traditional scam which uses an alert window, clicking any button, or entering anything in the text fields, will just bring the pop-up back. You can use the below steps to get rid of it.

Close the Tab

Though you will probably have to quit Safari, you can first try closing the tab by pressing Command + W. Most pop-ups of this variety will prevent closing the tab, but it is worth a try. If you see a scam in the form of an authentication dialog as described above, pressing the return and and then immediately pressing Command + W might work, as there is a short delay while the drop-down animation for the prompt window loads.

Quit Safari

Often, these pop-ups will not go away by attempting to close the tab, as mentioned above, nor by clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command ⌘ + option + esc, select Safari, and press Force Quit.

Relaunch Safari

If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while launching Safari. This will prevent windows that were open the last time Safari was running from reopening. This will not work in all cases. The shift key must be held at the right time, and even if done correctly, occasionally the window reopens. Even if the shift key trick works, it will prevent all windows from reopening, and you may have other tabs open that you do not want to lose. If so, try the suggestion below.

Disconnect from the Internet

After force quitting Safari, turn off Wi-Fi in the upper right of the macOS menu bar or disconnect the Ethernet cable, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. You could also try closing the tab if you had multiple tabs open. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.

None of this Worked!

If pressing Command + W does not work, and force quitting Safari and restarting the application with the Shift key held down does not get rid of the pop-up, you will have to reset Safari. Normally, this can be done by launching Safari, going to the menu bar, and then clicking Safari > Reset Safari. However, most pop-ups of this variety will block access to many of the drop-down menus in the menu bar. You will need to locate the file specified below on the computer and move it to the trash. Make sure you quit Safari first (force quit if necessary).

To start, open Finder. Then press Command ⌘ + Shift + G, or in the menu bar, select Go > Go to Folder. Type the following file path:

~/Library/Preferences

It is important to include the tilde (~) symbol, as this represents the path to your user directory. Now, look for a file named com.apple.Safari.plist, and drag it to the trash. Then restart your Mac. After it reboots, try launching Safari. A new preferences file should have been automatically created, so no more action is required on your part, and the pop-up should now be gone.

Another file you can try removing (in OS X Lion (10.7) or later) if the problem is still not resolved is com.apple.Safari.savedState, which can be found in:

~/Library/Saved Application State

If removing the above files still didn't solve your problem, one last file to try removing is named LastSession.plist. It is found in:

~/Library/Safari

The Source of the Scam

In addition to the FBI scam, there are webpages with bogus technical support pop-ups or "security alerts," claiming you have a virus as described earlier. These webpages include but are not limited to:

macsecurityissue.com

iosissue.xyz

applesecurityalert.com

com-internet-security-review.review

sysonlinesafeties.net

mac-system-alerts.com

helpmesupport.today

safari-secure.info

newsofware.com

apple-care-warning.com

safaricontact-help.com

macsecurities-alert.com

alertsmaconline.com

computervirusdetected.club

macsupporthelp.com

onlinemacsystemsupport.com

remotecomputertechhelp.info

mac-online-support.com

safari-home.com

online-mac-issues.com

interstech.info

com-officialmessage.com

iossecurityalert.com

system-protection.info

apple-secure.net

ios-mobile-alert.com

onlinesupportnetworks.com

tech-help-online-alert.com

mac-securities.com

apple-secured.info

contactpchelp.com

firewall-alert-triggered.com

detection-alert.in

com-privatemessage.com

systemsecurityalert.com

safari-code.net

pcsupportadviser.com

apple--computer--error--messsage.us

serving-sys.com

computer-warning.net

macbrowsersuspicious.com

browsersupportapp.com

browsesafemac.com

securityupdatealert.com

safari-net-help.com

applesecurity-alert.com

safari-issues.com

upgrader.xyz

If you come across a pop-up like those described in this article and you do not see it listed above, please make a comment at the end of this article, and include the URL.

ScamZapper

Mac users: You can download our free Safari extension, ScamZapper, to prevent sites responsible for such pop-ups from loading in the first place. See this page to learn more: ScamZapper. Please note that ScamZapper is not an ad blocker - it only blocks a certain kind of pop-up, like the ones mentioned in this article. Traditional pop-up or ad blockers typically do not catch these pop-ups. ScamZapper's corresponding application can also perform the above troubleshooting procedures for you if you are having trouble with them. Choose "Troubleshoot Pop-up" from the main menu to be taken through automated troubleshooting.

ScamZapper maintains a database of websites known to display these scams and will prevent them from loading, and version 2.0 and later also contain a technology which will block any page that meets a set of criteria that all of these scam webpages have in common.

If you encounter a pop-up like this, you should be able to close Safari by simply pressing the home button. If not, and you are using iOS 6 or earlier, try double pressing the home button, hold your finger on the Safari icon until it starts to jiggle, then tap the minus sign. In iOS 7 and later, after double pressing the home button, swipe upward on the screen showing Safari. This won't delete Safari, just force it to close. If that still does not work, hold the power button until you see "slide to power off" on the screen. Instead of powering off, release the power button and then hold the home button for around 5-6 seconds until you are returned to the home screen.

Once you have closed Safari, if you are using iOS 8 or later, go to Settings > Safari > Clear History and Website Data. In iOS 7 and earlier, the menu will read "Clear Cookies and Data." Clear History is a separate option, but you should not need to use that unless clearing the data did not solve your problem.

What if I Called the Number?

There may be cause for concern if you were not aware this was a scam and called the number in the pop-up. If you gave them your credit card information, you should call your bank as soon as possible, ask them to reverse the charge, and explain what happened to them, so they might consider blocking charges from the scammers altogether. If you are using an iOS device, the scammers probably just asked for money. If you are using a Mac, they probably asked for money, but also may have told you to install some software on your computer or give them remote access. There is no telling what that software might do, or what they might have done while they had access to your computer. (NOTE: You do not need to do any of the following unless the scammers installed anything on your computer - the pop-up alone is not a cause for concern about compromised data). If you are using OS X Lion (10.7) or later, reboot your Mac, and hold the Command ⌘ and R keys until you are taken to OS X's recovery partition. For earlier Mac OS X versions, insert the install disk that came with your Mac, and hold the C key while booting up your Mac.

If you made a Time Machine backup before you called the number, you can restore from that. Otherwise, the only way to be absolutely safe is to erase your hard drive (if you have important data that was not backed up, you can manually save these files to a flash drive, etc. before proceeding). In the Recovery partition, instead of selecting Time Machine, select Disk Utility. When it opens, select Macintosh HD (or whatever your partition is named) from the sidebar. Go to the Erase tab (it is one of the tabs near the top of the window), and click on "Erase" in the bottom right of the window.

Then, after the erase is done, you can set up macOS from scratch and not have to worry about the scammers.

It is important to note two things to identify scams like this going forward: 1) Apple will never tell you to contact them via a pop-up. 2) If you are being told to contact Apple, find the appropriate contact information at http://apple.com/contact, instead of using the number or email provided in a pop-up or a suspicious website or email.

I have gone through the steps described and everything appears to be
normal again. When the bogus pop up came on, I would get a warning from
WOT (Web Of Trust) and it would give me an option to accept or decline
which worked quite well. Hopefully I won't be getting these any longer.
Thanks once again for your excellent advise/help.

Did you try the other suggestions first? If they didn't work, then note that the Library folder which contains the file you're looking for is hidden by default, that's why you need to type in "~/Library" in Finder's Go to Folder window. Be sure to include the "~" symbol, which represents the file path to your user folder.

Isn't there some way to make it unattractive for companies like this to
put unwanted, hard-to-kill pop-ups on our browser windows? I might be
willing to sign up for a revenge service that sends them a million bogus
requests per day and calls their toll-free numbers with useless
recordings!

I've had a lot of troubles lately, pop up windows reoccuring very often
as soon as I browse the web, message WINDOWS FIREWALL WARNING their name
is, supposedly, ''instants-pc-fix.com''. They ask to call this phoney
phone nr : 877 404-4030 (?) Difficult to get rid of 'em.

You said "popups," plural? This article is for a specific kind of pop-up, the kind the locks up Safari and claims that your computer is infected. If you are experiencing multiple pop-ups that you get redirected to when visiting other sites, and see pop-ups for software such as MacKeeper, this could be due to adware installed on your computer. Please describe more what you're seeing.

So glad I found this. Safari was completely frozen/hijacked. The Safari
Alert popup came from a2ztech.us with the number 1-888-315-9643. didn't
bother calling because I knew it was a scam/hostage thing. I had to
delete the Safari plist file>reboot>restart Safari holding the
shift key. The latter is VERY important. Otherwise you have to start
over.
Thanks for the help!

Hi, thanks for your article. I got the pop-up instants-pc-fix.com and it
says my computer was infected. I didn't know what to do so I just
closed my mac with the power button and since that it never came back.
Is it alright or should I do something more? Thanks!

So far, so good! I picked up a forced download pop up screen for
"dl.pspvideodownloaupdate". A pop up showing the Safari icon but with
no "X" (close) options appeared while doing a Google image search. I had
clicked on a video link and was making choices too quickly! After
several attempts to restart Safari I decided to make the nuclear option
and update the OS to Yosemite. No luck: It worked for a bit then the pop
up demon came back. I found this article using my iPad and dumped the
plist as suggested and all is well so far. Thanks to all.

THANK YOU, thank you!!! This was the most helpful article I found online, and following your instructions fixed my issue!

I
had a strange popup from a website called "appsom1" trying to force me
to download MplayerX. Holding down the shift key while opening Safari
finally released my Mac from this nasty stranglehold. Thanks again!

Do you recall the exact URL of the webpage that was trying to get you to download MplayerX? The domain is "appsom1.com," but there is usually a page within this domain, for example "appsom1.com/popup.php," which hosts the malicious prompt. We need to know this in order to verify that the page is actually malicious before we add it to our article. It you can't remember, don't worry.

Thank you!!! I found it simplest to just turn off wifi, force-quit and
restart Safari. I could only get a screenshot of the link, as it tried
to shut down all functions until I downloaded their update. I've
retyped it here:

This article showed me exactly what to do to when a pop up tried to
force me to download "Download manager" from skyvideoplayer.com. I
couldn't close out of Safari!!!! and I couldn't figure out how to get
the pop up off my screen. Force quit using the keys on the keyboard
worked for me. THank you!!!

Another one i found -- url4short.info . I already had some idea of how
to get away from bogus safari alerts, so I got away, but...

(I'd
been to a non-malicious site where the author had a bad habit of rudely
using safari alerts to make sure you read through something; I
eventually figured out how to escape the trap if i accidentally visited
the page and didn't feel like going through the whole thing again. Must
thank the guy, it was good training for the future!)

I HAD A POP UP THAT MADE MY COMPUTER IFROZEN AND THE ONLY WAY WOULD HAVE
BENN TO CHECK "OK" AND CONTINUE-NO WAY TO X OUT WAS PROVIDED.

I
TRIED EACH SUGGESTED FIX WITH NO LUCK. FINALLY THE LAST ONE WHERE YOU GO
TO FINDER, ~LIBRARIE/PREFERENCES... AND YOU DRAG THE SAFARI
PREFERENCE IN TO THE TRASH CAN-THAT WORKED.

ONE HINT: WHEN I
CLOSED DOWN THE COMPUTER IT ASKED IF I WANTED TO KEEP THE REMAINING
WINDOWS OPEN THE FIRST TIME I CHOSE YES AND THE BLASTED POP UP RETURNED.
I REPEATED THE PROCESS AGAIN AND ANSWERED "NO: AND THEN IT FINALLY LET
GO! THANK GOODNESS! AND THANK YOU FOR THE HELP! BOTH TIMES THE POP UP
APPEARED WHEN I MIS-SPELLED GMAIL.

None of these have worked for me which is weird since it's worked for
everyone else. I try moving the file to trash and restart, but whenever I
restart safari it still opens up with the same pop-up that "suspicious
activity is detected, call toll free" and the file is back in finder.
Any ideas??

Did you try all three of the other suggestions- Command + W; force quit and hold Shift; quit, turn off Wi-Fi, and relaunch Safari? If so, there is another file you could try removing, and it can be found in ~/Library/Saved Application State/com.apple.Safari.savedState. Drag that whole folder to the trash and restart again.

My poor husband--he has been complaining about these symptoms since
mid-December as he was shopping . . . and I just now have examined what
he's complaining about. I think he had been suckered into many clicks
and has several of these Safari popup scams befuddling him. I took all
the instructions offered here and spent about an hour executing them,
over and over and over. It seems there are still two or three popups
that have survived my best efforts. For now, I'm just telling him to try
to remember to use Firefox. I'm pretty Mac savvy, but have never run up
against this challenge. Phew! Any further suggestions? Can I delete
Safari completely and reinstall?

Just saw this last suggestion: "it can be found in ~/Library/Saved
Application State/com.apple.Safari.savedState. Drag that whole folder to
the trash and restart again." I'll go trash the folder and try again.

The symptoms you describe don't sound like the typical JavaScript browser hijack that this article addresses. It's entirely possible that the culprit is some form of adware. Try scanning for adware with AdwareMedic: http://adwaremedic.com/index.php. Let us know if it finds anything.

I'll go give your suggestion a try. I can't even get the Safari browser
to go to google.com! Evon the apple.com website, a subtle line of code
at the top left has a rolling # of sentences also, with little URLs
after them.

I tried the STATE throw away and it didn't work. Off to try adaware.

Thank
you for your clear advice(s). Another thought--in preferences Excel and
Powerpoint, there are plist files that had their last uses today. Could
this be coming through via MSO?

Thanks again for the suggestions. I downloaded and ran adawaremedic.com
and I had a long list of things to remove. If you want a copy of that
list, I could send it to you. It also suggested throwing away and
downloading/installing Firefox, so I that, too.

Looks like
adawaremedic removed something called Trovi in the list. Also Buca Apps
had 12 related files. Downlite had 4 files. Conduit had 5 files.

Thank you for this. After fighting this for several weeks I called them
and read them the riot act. His advise was to pay someone to fix my
computer. I told him I know how to do that what I wanted to know was how
to remove his illegal advertizing from my computer. He wanted to have
remote access I said no he asked why I told him I don't trust you he
said if "If you don't trust me we have a problem" I said "no I will only
have a proble if I trust you.
I tried your solution it looks like it worked --- thank you. The pop up I received was: Http://mac-alerts.com

A scam alert popped-up stating my computer has been infected with a
virus when I visited www.wewather.com . I was trying to reach
weather.com but typed the url incorrectly. Thank you for this article
reinforcing what I intuitively knew.

Thank you! Thank you! Thank you! I called Apple Support and they were
going to make me pay $30 just to help me. I quickly did a google search
and found this article to get help for my ipad. Issue fixed!

Thank you! I found this on Chrome while Safari was hijacked and, like
others, found it to be the most helpful. I had tried updating both
Safari AND my Mac's security software while this was happening, but the
popup didn't go away. Shift while restarting Safari did the trick.
Should I still delete files or does it seem like it's done once you've
restarted safely?
I believe the site which caused it was something
like radarmp3. The popup said it was applehelp.net (I didn't see this on
your domain list) and included a 1-844 number to call. That's all the
info I have.

You do not need to perform additional steps outlined in this article once you get to one that solves your issue.

We can't find any page on the applehelp.net domain that triggers a pop-up like this. Unfortunately, if you cannot remember the exact URL, we won't be able to add it to the list. This is just a precaution to make sure we do not add a legitimate website to the list.

Thank you again. I just checked my history and this was the URL that showed up under the popup: http://www.applehelp.net/error14065689efmnwqpr123789245wplatpewbkac789127423525741397wpmwikzbdebvalue

parsingerror.php

But
that only happened after I had been to another site. This page appeared
just before the "hacking" popup above (I've only deleted the filename
at the end):
http://adf.ly/8328746/http://radarmp3.com/player.php?fid=o79WYIYcRAw

THANK YOU! the last option finally worked for me with the
"softareupdaterlp.com. Wasted 3 hrs of my time last night. I was using
my iphone to try to find info, as I'd also let me IPad Battery
completely die & was also trying to get that to work. I even went so
far as to sign up for the Genius Bar, not ez to do using just an iPhone.

They will either tell you to pay them a lot of money to remove the imaginary "virus," and/or ask you to give them remote access to your computer. If you gave them access and/or they installed anything on your computer, you should consider it compromised, and the only way to be absolutely safe is to erase your drive.

Thank you!! Much better than ANYTHING... and most def better than
anything from Apple. I have a MacBook Pro - and Safari is part of the
operating system, so I couldn't just remove Safari and reinstall it.
This was so simple a solution - I had to go into the folder through
finder and delete the file... thank you thank you thank you - was
looking for a solution for over a day... got the infection from clicking
on a Facebook friend's article... not an ad - so this snuck up on me...
very stealth...

I have gone through these steps and deleted the files many times,
restarted my computer. When I open Safari again everything is okay, but
after a few minutes the pop up comes back, how do I get rid of it
permanently?

Are you visiting the same website each time you launch Safari? If so, it could be that the particular website is malicious or has been hacked to redirect to that pop-up. If not, it could be that your wireless router has been hacked into. A temporary solution would be to download our ScamZapper Safari extension, which will stop the pop-up page from loading so you don't have to force quit Safari and you can continue browsing. We can offer additional suggestions if you can answer the question about the webpage.

Hi... I got this error message on my iPad, so I shut down, rebooted and
went into my settings to clear internet history. Now i cannot connect
to my wifi. I even cleared my wifi history and manually typed in the
password, but it is not working. I just get that "connecting" spinning
wheel thing like it's trying to connect, but won't. Any suggestions.

Thank you! I've been pulling my hair out over it, but finally got it.
I had to reset everything including restarting my router and manually
entering my router info and password. It definitely started with that
"suspicious" error message, though.

Easy, just close Safari and open an app that will open a tab in Safari,
like Facebook. It will open the link in FB, so just use the up arrow in a
box on the upper right and ask to "open in Safari." Once you do that,
it will redirect you away from the hijack tab. Open the "stack" and
delete the hijacked tab.

You must FIRST disconnect your computer from the internet and then
relaunch “Safari” then and ONLY then will you be able to delete the
OFFENDING PAGE!!! I did all above with much success and am very pleased
with the result. Just follow the instructions…

REMEMBER ONCE THOSE FILES ARE DELETED, BACK UP YOUR COMPUTER JUST INCASE!

These safari pop ups saying my system is in trouble are very irritating.
They
are tough to get around. If anyone out their could somehow get these
*** holes!!!!!!!!! they would be heroes. So please hackers anyone who
can please get these people. [...] Its like having someone
break into your home, and be powerless to get them out [...] Thats really the most important
thing, just knowing they got what was coming to them.

Since we developed ScamZapper, we're biased, but we think it's good! 😄 The scam webpage you encountered is already in ScamZapper's database along with dozens of others, and it is updated every few days, so you shouldn't have to deal with too many pop-ups like that again.

This was completely precise and accurate advise. I had to go all the way
to the last step--deleting to TRASH a file from safari/plist. But it
worked. And no doubt the scammers wanted to set up a dual computer
monitoring session so they could get anything they wanted from my
computer. Bravo!!!

managed to "beat the popup to the punch" by having the cursor placed
exactly on the red delete button and pressed it before page could grab
hold after quitting Safari and relaunching. Wished I'd found your page
before spending hours freaking out. You are now bookmarked and I have
actually used pen and paper; yeh, they still exist, and wrote ALL this
down. I'm ready for 'em next time! Thank you SO VERY MUCH for for being
there for us computer illiterates!

another website pop-up is mac-notify.com. Similar to the others, pop-up
gives warning of suspicious activity, with number to call to get it
fixed. this one also hijacks the default homepage, setting it to a bogus
Google search page. Renders Safari almost completely useless.

I assume that when you called, they asked you to install software or connect to a webpage that allowed them to have full access to your computer. In that case, the only way to be safe would be to erase your hard drive and start from scratch. Back up important data first.

Really glad I am not the only one who called the number...I didn't know what else to do! When I called someone just told me to power down the iPad and leave it off for 5-10 minutes. When I did I was able to shut down that window. I tried running the AdwareMedic but it says Safari won't download it! Am I okay?

AdwareMedic is an application for OS X, not for iOS devices like the iPad. This problem is not caused by adware anyway. Since the person you talked to did not ask you to install anything, you are safe, and there is no known spyware affecting iOS. The only thing you have to worry about is if you paid them money. You should talk to your bank and ask them to reverse the charge.

I called and the asked for my name and number. The guy remote logged in to my computer and looked at all my sleeping files. I didn't feel comfortable so I kicked him out. Do you think he put something on my computer?

VERY INTELLIGENT, SEEMINGLY HONEST, AND PRACTICAL ARTICLE. I am a past
Mac Technician (now retired), and have not seen a subject handled so
comprehensively. I used to belong to my local Apple Club years ago, and
will support your organization now.

THANK YOU SO MUCH for narrowing down my choices to attack this problem on my Mac Mini OSX 10.9.5 Maverick!

I called and they told me to install rescue logmein rescue and i allowed
them to get remote access. THE GUY WAS A BOATER FROM INDIA and his name
was nick.. SHOULD OF KNOWN RIGHT THEN and there.. but anyways so he
went to spotlight and on my terminal and told me someone from nigeria
had compromised my laptop and that its not running as it should. i could
pay him 199.99 or go to the apple store for an additional 100. i said
no and hung up so now I'm worried about what they might have done during
the process of the remote access.. so this literally just happened 30
mins and I'm reading more into it. My question is so i deleted the app
and restarted my comp and looking to see traces of the logmein rescue
app and its all gone. besides reinstalling everything. is there any
other way?? giving him remote access compromised my laptop even though
it was for a no longer then 10 mins

Unfortunately, the only way to make sure you're safe is to do one of the procedures in the "What if I Called the Number?" section of this article: restore from a Time Machine backup made before access was given, or erase the drive.

I accessed a website and received this message on my Macbook Pro. I
couldn't exit the page. Turned off my mac holding the off button far
too long. When I turned it back on this page appeared. I did call the
number, listed, but called from my lan line. Within a second, I hung
up.

What happens when you open Safari - what page loads? Sometimes, in addition to this malicious pop-up, the website you visited that caused the problem will also download and install adware. See the "Adware" section of this article.

This article helped me so much ! I went on this website and there were
like 4 popup windows trying to say i have a virus problem and i couldnt
use safari i tried opening safari with wifi off then i turned it on and
cleared all history so it worked im so happy never will i go on those
websites !

My safari browser was completely locked up with that pop up from ****.
Absolutely
nothing worked, my options were greyed out and I couldn't access
anything that wasn't the pop up's "OK" button. And even that just
brought the pop up back in a split second. I couldn't get rid of the
**** thing no matter what I tried.

Thank you SO much!!!!
I had a pop up named "iodisk-err-Windows software"
Told me my Windows pc had become infected with adware virus.. Since I am using a Mac this definitely failed to fool me!
Thank you so much again helped so much!

This happend to me and I called the number and gave them access to my
computer, as they were on my computer I typed in the key words to the
pop up on my phone, I then came.upon this page and exited put of
everything they were doing and cussed them out as fast as I could. Any
ideas on whether my computer is okay? I didnt give them any account
information to Any of my credit cards or anything....

this happend to my ipad it is fine now after going into settings and
clearing the history...i called the number and i told the man i got a
pop up message that said to call this number and he immediately told me i
need to pay $100 to get rid of it without asking any questions...and i
asked will this be charged to my credit card on file at apple? he said
no you have to do it over the phone...and i replyed that this sounds
kinda fishy...and real smug he says What? then go to the apple store k
bye...so i did some google and found this site...thanks for your help

Hi,
Thank you so much for this helpful article, I got a Chrome Alert
with this number on it 1-855-408-7834, I was freaking out so i called
the number, the person who answered t thought i have a PC, when asked
if it is Mac support the person told me that they are both helping Mac
and PC, he give me this website
https://secure.logmeinrescue.com/Customer/Code.aspx and asked me to
enter a code, since the guy sounded so shady, i didn't enter the code,
and hung up the phone. Few minutes later someone called me back from
this number 1-212-321-4556 asking if i need any help because i called
them, I said no and hung up again. I searched the internet and came
across this article, I followed the steps and it worked, thank you.

That sounds like a particularly nasty one! Do you remember the URL? You can go to the History menu in Safari and then click on Show History, then look in the "address" column. You can see the web address this way without actually loading the page.

I called the number and was a bit suspicious.. he took me to the page
where i have to type in a 6 digit code so they have access of the
computer. i typed it in but then last minute thought nah this is too
suspicious so i didn't press download. I'm a little bit worried now, how
can i tell if they had access or if it downloaded? thanks

this is so important guys.. I'm new to mac and an alert came up on
safari.. blocking all actions, the alert said to call safari tech
support.. I did and next minute they were remotely controlling my
computer.

Hello, I tried doing the ~/Library searches, and when I delete the
indicated files and restart Safari opens normally once. When I close it
out, it opens up with the same search engine that has been plaguing me
this week. It is called "search-quick.com". Initially I had the pop
ups from the mac-systems-alert page and the steps from above removed all
that, except now this search engine will not go away. I have
reinstalled OSX, every time I open safari I go to preferences and set
everything to where it should be (no java, homepage, etc). Just when it
looks ok and I reopen Safari, the false engine takes over once again.
Help!!
Thanks in advance

I got a popup from www.trk-11-check-online-8.com and a screenshot of a
similar event is at https://urlquery.net/report.php?id=1426872081064
I'm on windows7 with google chrome. I don't recall the actual url that
triggered it, but it was probably an "apply now" button on
www.ziprecruiter.com. I don't recall the exact url because I was also
researching Matlab alternatives at http://www.opensourcealternative.org/
I strongly suspect ziprecruiter, but I had many other tabs open. I
was able to call up Task Manager and I tried killing Chrome processes
starting with the highest (latest?) PID first, but it killed the entire
Chrome process. Re-opened, then restored tabs and all OK.

The popup I got was pcassists.info. I clicked on the OK button a few
times in the window that was telling me to call 1 877 899-1824. Soon
after that, I could no longer access the preferences in Safari. Luckily I
read an instruction to start Safari while holding down the Shift key,
and it seems to have done the trick. This is the second time this has
happened. The last was about a year ago. I've printed your instructions
to have for further reference. I'm not sure how to provide the url.

This worked great. I did call the number but suspected something was
wrong when I asked the Indian call taker if he was associated with
Apple. He could not give me a definitive answer and wanted me to let him
have remote access to my computer. He repeatedly wanted access to my
system until I finally said I'll call you back n hung up.
These people need to be arrested.

Thank you for the help! I had to delete the file
com.apple.Safari.savedState before I could get rid of the problem. The
URL causing the trouble was http://help.portenttech.com
I am in full
agreement with a previous suggestion - can somebody please come up with
a retaliatory software with which we can spam the spammers?! Enough of
this nonsense!

It worked! Thankyou! My son went to some movie site and then the window
appeard and would not close! I shut the wifi and followed the
instructions. I did call the number just to see and some Indian guy
answered. I said i had the wrong number and hung up and they called me
back! I hope they dont do anything with my number. Hope this helps
someone else and thanks again!

This notification told me
that A major security issue was detected and that suspicious activity
might have been detected. I called and the indian dude had me set up a
support.me system where he had access to my computer which was plugged
into my phone. I have to say, it was pretty convincing when he did a
scan that looked super official and intimidating to anyone who know
nothing about code. It even ended with "network hacked". I was like
woahhhh crap how do I fix it? He WOULDNT ANSWER. He went on saying, "Im
getting there". then proceeded to tell me what these "RUSSIAN HACKERS"
could do and get all my passwords and bank accound info. I was like BRO
how do I fix it? He still wouldnt directly answer. Then he set up a
notepad and wrote out steps about how to fix it. He told me to call a
certain company of networkers who would install a software or something
to fix my network and clean it, tune it up, and make it faster. I was
like okay how much does it cost? NO DIRECT ANSWER. I was pretty sure it
was a scam at this point. Especially because of how insistent he was.
Very pushy. He finally told me it was like $146 and I was like UH HUH
NO. He said can you afford $99 and Im like NO. Thanks for yo time, pal.
BYE. So yeah....how I fixed it was by deleting all my apps with
important info on them and re installing them for safety, but turned off
my wifi and cleared the safari pages i had open. Then I turned my wifi
back on and the pesky notification went away. All fixed! No money, no
hackers, and i went on with my day. Hope this helps! Btw....the number
they told me to call is 8555690204
I was able to call it back so its not a telemarketer. Just a scam.

I didn't see this article until after the fact. I had a pop up that
disabled all functions... so in a haste, I shut down my computer by
pressing the power button. This shut down my Macbook Pro, but it
restarted with the same windows, but I managed to close everything then.
When I restarted it, I was getting a weird grey globe logo at the
startup. I managed to fix this by going through the system preferences,
but now I'm seeing a grey apple logo at start up. Start up starts with a
blue apple logo with gears, then goes to a grey background with apple
logo then to my login. Can someone tell me what is going on? How can I
resolve this issue? Thank you

Hi there,
Thank you for your advice! Unfortunately, your suggestions
did not resolve my issue, as i'm still getting the pop-up. Do you have
any other suggestions? When i've removed the suggested folder you
mentioned under Library and Library Preferences, and the pop up comes
back, when i go back into Finder, the folders are there again. I think
the pop up is coming through Facebook. Suggestions? Thanks!

I restarted my computer and still the pop ups came up when I opened
safari... I was astonished and then very concerned. I'm so glad that
this was the first article that I read. It was well written and
comprehensive. I held down the shift key when starting up safari and it
did the trick. Thank you so much! You made my day 😊

www.mygpsworld.com is the scamming web address that popped up for me and it acts like Norton anti-virus software and tells you your computer is infected and you MUST call the toll-free number. I couldn't get rid of the pop-up message, but thanks to this article I was finally able to!! Thank you!

Your instructions for iOS users worked like a charm! I deleted cookies and data in settings and voila-no more tab with the nasty pop-up. It's only option was "OK," so I knew not to click on it. Thanks, I'm bookmarking your page. 👍👍👍

I strongly doubt that the page was magically able to load without an Internet connection, as one of the steps suggested in this article is to quit Safari, turn off Wi-Fi (or unplug Ethernet if that is what you use), and then relaunch Safari.

I'm getting a "can't find the server" error when I try to visit that page... are you sure about that URL? With Safari open, you can go to History > Show History to see the URL of the page without actually visiting it.

I need help. The safari restart is not working and the coloured mouse ball is still turning not letting me quit or close down anything. I tried to force quit the safari icon and disconnected the wifi and have reopened the safari page and clicked out of the tab but when I reopen safari and turn wifi back on it automatically comes back on HELP

I don't see anywhere in your comment where you mentioned trying holding the shift key when relaunching Safari. If you haven't tried that already, repeat the steps you tried (turn off Wi-Fi, quit Safari, close out of the tab, quit Safari again), but before you re-enable Wi-Fi and relaunch Safari, hold down the shift key when opening Safari, and you should see a brand new window with no tabs open. If, for some reason, that still does not work, while you have your Wi-Fi turned off, launch Safari, and in the menu bar go to Safari > Preferences > Privacy > Details (next to "Cookies and website data"), look for the webpage that was displaying the pop-up, and click Remove. If you are not sure what the webpage was, to be safe, click "Remove All Website Data" from the Privacy pane in Safari's preferences.

THANK YOU , THANK YOU, THANK YOU, Not only did your instructions about the shift key and disconnecting from the internet steps work, I was relieved to find out that you also made sure to note that just the pop up alone will not compromise my MAC. SO helpful!! cant thank you enough!

I got the pop up with the phone number 1 888 258 5284; I initially believed it and called, but when the person told me to go to www.support.me which is not listed above - , I became suspicious and asked him to give me some form of identification that he was apple support. He said that that was just the default number and that he couldn't give me anything else to prove his ID. At that point I told him I would call him back and hang up the phone. I did not run the software they wanted me to, which the guy said was to give them access to me computer (which also made me suspicious).

Thanks a million. I put watch chelsea v Leicester live & received the pop up advising me to call +44 808 143 3684. I rang the supposedly free number. I was advised I need to have access to a computer. TG I was too lazy to set it up. I rang my son who advised me it was a scam. I found this site & followed the IOS part. Thank you very much again.

I had a pretty bad variant of this. I tried all your tricks short of wiping out the preference plist and none of those work. However, I deleted ~/Library/Safari/LastSession.plist and restarted Safari successfully. I believe that my variant of the hack was associated to www.system-securities.info and their phone number 877-899-1824.

I tried everything I could just to get Safari to be operable again. Nothing worked until I was able to make a google search through Google Chrome browser. I came across this post and it worked perfectly! Thank you so much. You've saved me a bunch of time, money and embarrassment!

If you can't find the files listed, you can download and run ScamZapper. On first run, it will install its Safari extension, which will prevent most pop-ups like this from appearing in the future. If you run ScamZapper again, click "Troubleshoot Pop-up." This will help you get rid of the current pop-up, including finding and deleting the files mentioned in this article if necessary.

I had to do ALL the steps to get Safari back up. However, it does not appear to be working correctly. It blinks several times when coming on and whichever site I open from the browser, has similar blinks when I scroll up or down. Am I still missing something? Help?

This came up when my wife was using Safari under Yosemite. The number that appeared was 1-844-521-0863. She phoned it and was led through freeing-up Safari, and then told to enter www.support.me. She did so, and a page of Google results appeared warning her of the scam, so she told the "techie" that she would let me talk to him when I got home.

The was THE BEST, MOST INFORMATIVE way to clear the "crap" off Safari. After trying many different options, I followed the suggestion of quitting Safari, turning off WiFi (or unplugging ethernet) and then reopening Safari. After closing all the tabs and clearing history, I was able to turn WiFi back on and open the web browser without any incident. BRAVO and THANK YOU!!!

I got a popup while using Chrome on my Mac. URL http://app.macoscleaner.com/secure/en8/index.html?voluumdata=vid..00000003-cd74-4ffd-8000-000000000000__vpid..96768000-0a09-11e5-8a9b-8fc4ca9759cf__caid..48dced12-25c7-4982-b011-527d198fa9ea__rt..DJ__lid..b1d13635-3362-4e00-b49f-3daef77eb6d5__oid1..07bb6eaa-c983-4d90-b4ad-3670b87ec557__var1..243192__rd..onclickads%5C.%5Cnet&zoneid=243192&visitor_id=74080680063

I got one from os-error.paves.co.in. The popup was extremely long, far
beyond the width of my screen. I got rid of it before reading this
article. I just kept force quitting Safari and starting it and I tried
to click the tab's "close" button in time. Took a few tries, but worked.

The popup I encountered which completely froze my access to Safari was
from "techsupportpros.co" (not ".com", which is a dead giveaway it's a
scam because I'm not aware of any ".co" domain). I had to go to the
second level of addressing the issue, meaning I had to junk both the
Safari .plist and the Saved State, but once I did, Safari seems to be
back to it's old self. Of course, when you delete a .plist file, you
lose everything under History, but that seems to me a very small price
to pay to regain control of what is my primary web browser. I also
downloaded ScamZapper to my Desktop immediately using Google Chrome,
just in case there were still any issues remaining with Safari that I
was not yet aware of. THANK YOU SO MUCH Matthew Leeper and Apple Club
for 1.) explaining what the **** was going on (this same problem has
happened to me in the past, but in those instances was always resolvable
with a Command-W window close. The one from the scumbags identified
above, was MUCH nastier and could not be resolved with a Command-W as
prior occurrences were), and 2.) offering for free what I hope will be a
solution in ScamZapper, although these guys are very smart and
calculating, and I'm sure it's a constant battle to try and stay ahead
of them. It's happened to me 4 or 5 times in the past, but never once
used the same language/presentation, or was from the same obviously
multiply redirected domain. There were always variations, sometimes
minor and sometimes not, but until this instance, had all been
resolvable using Command-W. In total exasperation, I did call the "tech
support" number from the popup (actually I got multiple popups, each
showing a completely different phone #, but all going in the same
place), and was eventually told by these malicious ******** (pardon the
crude expression, but I think it's appropriate in this situation) that
they were "Apple's outsourced Tech Support Department", and, just as you
said, telling me I had to buy and install additional software at a cost
of $180 USD to prevent it from occurring again. When I asked very
specific questions about their alleged relationship with Apple, such as
why this software wasn't available from Apple but only through them and
told them I'd have to hear that directly from Apple before I gave them
any information whatsoever, they disconnected me without another word,
which sealed the deal for me that they were the lowest form of online
extortionists. Word of advice: always have at least one, and probably
several, alternative browsers installed, updated and ready to use even
if Safari is your browser of choice, because if I hadn't had Chrome, I
wouldn't have found Apple Club and have no idea how things would've
turned out. Thank you again, Matthew Leeper and Apple Club, for your
very clear and concise process to resolve this ugly scam, for providing
ScamZapper as a free download, and for keeping it as updated as
possible, because scammers are constantly tweaking their methods to stay
one step ahead of most Safari users, and, I'd imagine, both Apple and
law enforcement. It ended up costing me over 8 hours of online time I
really needed, but the outcome could've been SO MUCH worse without you.
Kudos to you all for what amounts to a public service. Kudos to you all.
I'm extremely grateful

thanks so much, your advice to quit Safari, turn off wi-fi, attempt to
navigate to Google and then turn the wi-fi on worked perfectly. Safari
was hijacked by support.mtdsupport.com and was instructing me to call a
number claiming to be from BellSouth.net

I downloaded what I thought was a free youtube to mp3 converter. So I
did install something on my computer that came as chip.dmg. I
immediately had my browser hijacked. As I realized that this was
happening, I force quit Safari and restarted my computer to to short
circuit the install of the download. I don't really know if I was
successful. I rebooted and ran Sophos Anti virus which found one mal
ware. I believe it was what I had been in the process of installing.
When I rebooted Safari I got a url to 247techquery.com and a popup box
with no close button telling me there was a security problem and to call
a 1-844 number. The scammers who answered told me they were part of
'global tech support". I was angry and did not treat them nicely. I
demanded to know what company they worked for and was told Technogeeks.
They wanted me to pay them to "fix" my computer and claimed that they
didn't know who technoquery was. And that their number was not the 1-844
number, but I had been routed to them. I called bullshit on them and
told them I would hang up and call back, which I did. Same folks in
Beirut. Scammers. I booted up Firefox and input the 247techquery.com
address and a bogus video download site loaded. I guess they are fishing
for suckers to download videos. I yelled at them for a while and got
nowhere. I've run disk doctor and found the dmg and trashed it. I'm
hoping that is all the damage that was done. Thanks for the
recommendations.

Scam phone number received as an follow-up popup to "Safari - alert"
popup while on Chrome on an iPad. This 2nd popup said to call 866 836
0831 because of problem with Safari. This message froze Chrome so had to
uninstall and reinstall Chrome to get it working again. Looked up phone
number on various reverse number sites, and it was not a credible
number.

Shift + relaunch worked and cleared website and data history. BHO by
redirect to url: mac-alert.co The pop up splash says: from
"s3-us-west-2-amazonaws.com" call 1-844-542-0018 Definite Scam
Parasite!!

1) Google's Safe Browsing service is what Safari uses to warn you about fraudulent websites. However, that won't help with pop-ups like these as they are typically slow to get added to Google's database, if at all. Anyway, that message means that either Google hasn't updated their service's database as the messages suggests, or Safari was unable to contact their server. Either way, it's not the result of foul play.

2) That won't be necessary. No website can read your passwords (unless it's a password for that same site).

I'm guessing that you were looking for speedtest.net, as opposed to speedtest.com, when you saw the pop-up. speedtest.com appears to be a knockoff site that redirects to "dntrax.com," which is responsible for the pop-up.

get-system-scan.com is another one. I got out of it by quitting Safari
and relaunching it with the Shift key pressed, as you suggest.
Unchecking Enable JavaScript in Safari Prefs also works. Unfortunately,
doing that means that you'll have to re-check it, in order for a lot of
other sites that you *do* want to see to load.

I stupidly paid the first time and I guess they installed something.
That was 4 months ago and now I got another popup. Applemaccare.us.
Naturally when I called and told them it was a scam and I was not paying
anything, the guy hung up.

http://mac-virus.info ...... got this yesterday. Called the number
(thinking it was probably a scam) and talked to the guy on the other end
just to see who it was and what they wanted. He claimed he was safari
and google chrome tech support. He wanted to know my computer type, the
age of it and what I was using at the time the message popped up. He
told me a few steps to do and told me that macs do not get viruses so it
was probably caused by a website that I had recently shopped on. He
claimed the only way to fix the problem was to go to accessmypc.net and
enter the code he gave me, which would then grant him access to my
computer so he could "clean out the bugs". He told me there was nothing I
could do on my own, the only option was to have him "help" me. He
claimed that even if I got a new computer the bugs would still be linked
to my information. (scary if you don't know this is a scam). He
insisted many times to grant him access to my computer. He even yelled
at me on the phone for questioning him about why I had to grant him
access. The whole time, I knew this was a scam so of course I didn't
give him any information about myself. He tried to scare me into giving
him this information, so at that point I just hung up and felt bad for
anyone who actually did give them their information. These guys are good
at scamming and convincing you that you need their help, but do not
fall for it !!!!

Hi,
Thanks for the above a great help! I stupidly called the number and the accessed my computer showed me a bunch of stuff. I ended up telling them I wouldn't pay as I realized it was a scam when he tried to open FaceTime!!
He did however ask if I was on wifi and now I am stressing out that he has access to other devices on the wifi network is this true? If so how do I prevent that? I have already wiped my mac as suggested!

Thank you so much for this in-depth step-by-step page about pop-up blockers. I was seriously worried when something came up like this and I can't close Safari. I'm pretty sure the pop-up came from macsecurityissue.com (but there's a small chance I'm wrong since I was panicking). I had to resort to removing com.apple.Safari.plist. https://www.facebook.com/*****/posts/***** this is where I got it from. :/

So pleased I found this site. Safari would not load w/o this almost
full screen notation that Adware had infiltrated, or such, Safari. Not
sure of the other information on the page. It was two (2) weeks ago
that it happened and shutting down Safari, the Mac Mini, etc would not
keep the page from showing up when trying to open Safari. I used my
laptop until today and found the site and tried opening Safari while
holding the Shift Key: ALAS all is fine and I thank you, and others who
commented. very much. Was a simple solution that made me very happy.
THANK YOU.

The article was very helpful. The first step didn't work, because the
scammer had blocked out all the options on the Safari menu bar. Going
further, I closed the application, then did the shift/open trick and it
opened in a clean copy. The offending instance was showing in the tiled
(recently opened) windows and I deleted those windows. Then I went to
History and deleted the past few day's history, hoping that will help
prevent recurrence.

One note - there was a key sequence of control-W or command-W given in the article for force quitting an application. That does not work with the version of OS that we are running. We have to use command-Q for a force quit.

The article correctly states that Command + W is for closing the tab in Safari, and Command + option + esc is for force quitting. Many of these pop-ups prevent Safari from being closed with a normal quit (Command + Q, as you state).

Hi, I don't normally comment on things like these but I'm just so
grateful. Unfortunately whatever I had was powerful so I had to
completely remove the safari file and restart, but it worked and that
****** popup is gone. Thanks so much for this page, it was extremely
helpful and easy to understand. Far better than any apple support I've
ever received.

http//67search.com message popped up saying about a virus was detected
and it tells you to call for support 855-409-2027. I called but didn't
give any info to them. They said they were Apple support. I was directed
to a site after I was told how to force quit Safari And open up a site
called "showmypc.com" I was suspicious when I got to this. I ended the
call because I had to work and decided to look this later which I'm glad
I did. I think my computer is safe.

Please contact apple support at (844) 502-1063 and provide error code WBACK7917 to scan and resolve any potential threats to your personal and financial information, which was being tracked by suspicious connection.

Consequently we are performing additional security checks to verify the source of the attack and have halted all your system resources in order to prevent any additional damage to your system and information.

Please call customer service at (844) 502-1063 to resolve issues."

The ad window extends past the bottom of my computer screen so there is no option to press okay or leave the page.

I did not call the number and went through to delete the files from library preferences, etc. Safari preferences is grayed out and I can't shut down the computer or quit safari. 😕

Since the pop-up prevents you from quitting Safari, you need to force quit. Instructions for that were included in this article; please review them. If you cannot get it to work, download our ScamZapper application, and choose "Troubleshoot Pop-up" from the main menu.

It's definitely not infected. The only times scams like these can infect a Mac is if you let it, i.e. allowing the scammers remote access, or running a program that their website downloaded. Just double-check your downloads folder, and delete anything you don't recognize.

THANK YOU!! I got a similar pop up from system-virus-detected{dot}com
I was immediately suspicious bc it said "windows firewall infected... Please visit your nearest windows service center" BUT I'm on a Mac using Safari.. Haven't used a windows computer in years!! I clicked ok to try to close but another pop up came up immediately which was so long it went off the page & I couldn't do anything so I force closed Safari & got on my phone to google this issue! So glad I read this before reopening safari.. I turned off wifi and then reopened safari & closed all of my tabs.. I also deleted my history from Mac & phone... Are there any other steps I need to take to protect myself? The pop up is gone.. I'm just concerned because I clicked "ok" on the first pop up.. I did NOT call the number or do anything else! Thank you again for taking the time to help us all!!

I got 2 of these on the same day, the first one I force-quitted so fast I only got the words "computer" and "Infected". I thought this was real once I got bombarded by the second one on a whole different website prompting me to get mackeeper. It even said "Earlier today you got infected" so it was very believable. At the time I didn't know what mackeeper was. Thankfully I removed it along with all its hidden files before I entered any personnel information.

Try this.. apple logo menu> system preferences> general> select “close windows when quitting an app”> open safari then immediately make sure to quit Safari using the menu option or command+Q. once you relaunch safari the problem should be resolved. worked for me. (this might not work if you can’t get safari to “quit”……. “force quit” is not the same)

I freaked out and called, but started to get suspicious when there was no mention of the company name or of Apple when it was answered. As I started talking to the guy, I was researching the phone number and the supposed website on my iPad. The guy asked if he could have remote access to my computer while I was reading it was a scam. I told him I'd have to call him back and hung up. Then I followed the instructions here, and everything seems fine now. THANK YOU. Time to stop surfing the web and go to bed.

Thank you so much for covering all the possible solutions so thoroughly. Updating OSX Yosemite, starting Safari while holding down the shift key and restarting Safari from a different page did the trick.

Just an FYI: the message I got made it look like Norton AntiVirus had done an online scan (I don't have Norton AntiVirus) and identified a trojan (Deal Ply) and spyware bot. The screen would freeze and I was warned that turning off the computer would lead to data loss. Of course I was directed to call a toll free number where someone would help me solve my problem.I just turned off my computer, did not launch Safari when I rebooted, and used Google Chrome to search for an answer, which is how I found your helpful advice. My neighbor's browser was hijacked the same way and she called the toll free number. She was told to download software to give them control of her computer, at which point she finally realized it was a scam.

Had a security error popup from this URL (below) that prevented all safari actions, even closing safari. I had to force quit via activity monitor. The suggestion of holding shift worked for me and the issue hasnt returned on subsequent opens. Thanks!

"secuirtyalert-report.info" saying that my Apple computer has been locked, the sSystem has been infected due to an unexpected error. Gave me a number to call (1-844-443-3868) "immediately to unlock your computer"....etc. Embarrasingly, I did call. But the number was out of service. I checked and did not see any downloads.

The alert from them was actually terrifying. I couldn't go to any of my other windows, and it blared a very loud alarm - like a fire alarm. I ended up just holding the power button until my computer shut off, and then turned it on again. It is back to normal.

Very, very helpful. I needed to use all of the recommendations to finally remove this pop up! BTW I called the number and started getting help from someone with Indian accent and then he asked to join my computer and that was the signal it wasn't legitimate. I asked for his company name and website and he would not share that!

My pop-up is now not letting me even force quit safari or let me shut down my computer. I had to hold my power key to shut it down and restart it. The site was macprotection.info/error/ something else... These pop-ups are really starting to get annoying...

Hey! I got the pop up saying that a virus had entered my system and to press "OK" to start the process to get rid of the virus. I didn't press it, just went for the force quit of Safari and then restarted my mac. When I started it again and went to Safari, everything was normal. Anyway, I wiped all history and cache from my Safari. So, probably a stupid question but just to make sure, this kind of stuff can't somehow actually introduce a virus to your computer right? And getting rid of the pop up is enough, there's no need to go through with all the other steps? I was thinking on installing the free version of ClamXav, the one they offer on their web for 30 days, but I now I don't know if I need it. My computer is working properly and the pop up hasn't reappeared. Thank you for taking the time to make this article, it has been a great way to learn more about these *************.

Is there any way to not delete everything on the computer if I watched (while I gave them control of my computer) and they did not install anything? I just have so many pictures and documents saved and I don't know how to go about getting them back if I delete everything.

If you are positive they didn't install anything, you can probably get away with not erasing the computer. The only other thing you would need to do then is call your bank to report the fraud if you paid them any money.

Had a detective screen pop up on my macintosh and not to sure wether it is safe to precede through, the URL is:http://apple.com----macupdate.co/healthcheck/VIRUS__FOUND.htm?os=OS%20X%2010.10%20Yosemite&city=Broadbeach&ip=58.173.218.62&device=DESKTOP&brand=Desktop&country=AU&browserversion=Safari%208&isp=Telstra%20Internet&site_id=&voluumdata=vid..00000000-d737-4be5-8000-000000000000__vpid..664e3800-62ab-11e5-875c-760669ea4b86__caid..d054d6fb-029d-4991-a362-965994ae4c0a__rt..D__lid..f6de71d4-8b50-4829-92dc-1965006c6e86__oid1..437c26ed-9a62-497e-b7f5-b3cc1f07db8f__var1..yankee-pac-5rBsUCBB__var4..NON-ADULT__var5..POPUP__rd..__aid..__sid..

THANK YOU!!! I got a popup from https://usamac.s3-ap-southeast-2.amazonaws.com/error-mac.html. I turned off wifi, had to force quit safari (most options were greyed out like you mentioned, and the popup scrolled way past bottom of screen, so I couldn't even see the button except when I drug the window around), and then I re-opend safari while offline and closed the offending popup, quit safari again, turned wifi back on and re-opened safari. Seems to be back to normal now. I don't see any downloads that happened.

Thanks. Excellent and comprehensive article. Before I wiped out the various files that screwed up my session I dug through the LastSession.plist file. Here's the malware URL (at least the first part. I don't want it to replicate)

This was incredibly helpful. Thank you so much for posting this. A website that was pretending to be from CNN selling iphones for $1 popped up and it would not let me close it out. I had to turn off the internet like you suggested to relaunch Safari safely. Thank you again!!!

The Safari preferences were greyed out, and everytime I clicked the fake warning dialog, another tab would open and another dialog would pop up. I had a lot of other Safari windows open, so I did not want ot reset and lose all that. What worked for me was to hold and press cmd-w for a few seconds to buffer up a bunch of “close tab” commands, and then press the return key to dismiss the dialog box. After doing that quite a few times, I slowly reduced the number of scam tabs open and eventually got them all closed. Have to be careful not to overshoot and close windows you want to keep.

A pop up appeared on Safari giving me a number to call claiming to be Apple. I cannot use the Safari browser at all due to this pop up. Regrettably I called the number and let them remotely get into my laptop!!!! I knew something wasn't right, but I wasn't sure! I can't believe I fell for this. I didn't give them any money although they were being very pushy which was a dead giveaway! However I did give them my name and birthdate. What can I do now to make sure they haven't accessed my private info? Please help.

I would suggest speaking to the Account Security team at Apple right away. To do that, call them at their main number, 1-800-MY-APPLE (this phone number is also on the Apple website), and ask to speak to the account security team. I would also suggest filing a complaint with the FTC here.

Cheers for the advice. I'd managed to shut the voice that blared out of my speakers and the blue 'warning' page down by a combination of cmd-W and leave page clicks. Can't remember exactly. But this information helped to make a next occurrence less stressful so thanks.

Didn't get the pop-up name but have the link I clicked that I believe it came from. Not sure whether it will help but I'll add it here anyway: http://17f5d8tjo2zhuc17z3wug0qkb8.hop.clickbank.net/

Thank you. I was on Safari on my iphone looking for phone ringtones when this occurred. I did call the number 800-717-9850 and was put on hold then disconnected. Your website was a lifesaver! Thank you again.

This post is useful because of the added mention of "restarting Safari".

The problem is, if this pop-up is here when I quit Safari, it may be back when I start it up again. Pressing "command w" immediately on startup, before the page loads, will keep the page from coming up. The alternative is to accept Safari's offer to not reopen tabs, but if you were running multiple important tabs this can be troublesome.

I have a pop up that is telling me to call a number. Not only will the tab not close, but it won't let me quit safari or even turn off my computer. It won't let me do anything with Safari. Please help?

Happy Thanksgiving. If you see this every time you download something, may I assume that you are getting all of your downloads from the same site? I recommend avoiding that site. It's usually a good practice to only download software from the developer's website, or the Mac App Store.

You can stop once you find a solution that works for you to get rid of the pop-up. You do not need to keep going. However, when they asked you to enter that code, did you comply? Did you allow them remote access? If not, you are okay, but if so, please see the "What if I Called the Number" section in this article.

I escaped by the skin of my teeth, at least that's how it feels, they hadn't given me the code yet, and I hadn't given them any info. When I asked about how much they expected me to pay, they answered and I hung up.

There is no cause for concern. You were actually quite lucky, as most of these pop-ups do not have a "Leave Page" button at all! It probably just had some message trying to dissuade you from leaving the page, but if the option was there, then there was no harm in clicking on it.

Thank you, thank you! Had a real time of it on Safari this afternoon until I found your site. Followed your directions and all is back to normal. I wished I had seen this a couple of years ago as I fell for a "virus" scam right after we got a new MacBook Air. Live and learn I suppose. Fortunately, it never manifested into anything other than a one time payment.

This just happened to me and unfortunately i was stupid enough to call. the number was 1-866-202-1568 and it was a very pushy woman on the phone with an Indian accent. the website that i found in my browsing history that would prompt the pop up was logmein123.com or something very similar. I downloaded some software like rescueme or something but deleted it and i'm trying to make sure i got everything off my computer. Hope this information can be useful to others.

The pop-up has two options: stay on page, or leave page. It tells me to click the "leave page" option to get £35,000 or whatever. Can't close it using keys, can't close it from the drop down menu for Safari. Tried forcing a restart, which got blocked by the application Safari, then tried shutting it down and the same thing happened. Finder wouldn't work for some reason. Had to force quit.

idk if the author will ever read this, but thank you so much! I was freaking out bc some website popped up and then like 10 odd tabs popped up with unknown website names then safari popped all these weird warning that wouldnt go away. I couldnt even open safari on my mac. Thankfully i had firefox. It's fixed now though, thank again. If my parents had found out i would've been dead.

Thanks for the tip to use Web of Trust extention. Downloading that now.
Also, turning off WiFi and using Command-W was what worked for me. Once I did that, I went to History and deleted the offending page that wanted to direct me to the download as well as the original link that I think started it.

The site name for the "media player" download was onefiveliveDOTcom (I think...I'm tired and I already deleted it), and the website I clicked on when it popped up was magicalprintablesDOTcom/index.php?route=product/product&productid=86.

Will see if I can report it to Web of Trust or somewhere. The only other link it seems like it could also possibly have been, looking through History, is hubpagesDOTcom/holidays/Transformers-Rescue-Bots-birthday-party-supplies-and-themed-ideas.
THANK YOU THANK YOU THANK YOU for the help article here!

Had a similar issue with the following website - should have read your article before. I clicked on "ok" got a website open that I closed immeaditely. Nothing in "download" folder, so hopefully I have not picked up anything.

Thanks a lot for this article. Command alt esc did work to shut down safari. Then I held shift while opening safari and the pop ups were all gone. I did call the number to see what if it lead to Apple customer service. But it was so bogus. Person picked up was definetly a male Indian probably based in Mumbai trying to get your credit card info. As soon as I knew it wasn't an apple repesenitive I hung up immediately.

2nd time having the problem on my husband's user, and misplaced my notes that fixed. will try these INSTRUCTIONS now and printed.. to keep in a pocket folder. Thank my Jesus doesn't affect other users.. unfortunately due to his health issues, he has 'time' to do Song pop, which seems to be the 2 times that occurred. Thank for the advice. DO YOU KNOW IF (ALONG WITH SCAM ZAPPER) DOWNLOADING MALWAREBYTES ANTI MALWARE FOR MAC WILL HELP WITH SUCH ADWARE TOO? God Bless you and others for the patience to care enough to help guide others. bye

Hey! Wonderful article. I'm using an iPhone 4, and a popup appeared that took over safari. I couldn't close it, as it would just reopen. I could close safari and do other things on my phone, though. Out of slight worry and curiosity, I did call the phone number in the popup. I could not hear anything, so I hung up about 15-20 seconds in. I shut off my phone and turned it back on again, and Safari is back to normal. Should I be worried that I called the number?

This article helped clear up a netwebs5.xyz flash player pop-up that wouldn't go away.It appeared I was hijacked since every Safari launch resulted in the pop-up returning even with my wi-fi disabled. But after following the instructions I saw it was a nuisance that could be dealt with and I'm restored. Incidentally, my AVG saw this as an HTML/Framer but even when AVG said I was clear, it still hoped up until using this article. Good luck!

Was on stackoverflow.com reading about a question, and someone made a reference to Tux Droid which I clicked on and it was hypertext linked to www.kyosh.com, it redirected to http://fatal-error.xyz... (I did not paste in entire message as that is the delivery method of the error).

I just had this pop up, and I wasn't sure, so I DID call the number. As soon as he asked for information to install, I told him no, that my husband handles all the network stuff and I would have him fix it. I then went through preferences and removed website data. I know I didn't do anything by calling since I gave them no info. But I just want to make sure I don't need to tell Safari to stop logging passwords or anything like that. They don't have access to anything just by having the popup on the page, right?

My pop up says "http://www.notices-alert-call. Phone number 1-877-796-1252. Error code WBACK7917 i think I have done everything you said to try. Using my iPad to contact you because I can't use my MAC lap book at all.

The "computer infected" pop-up came from a listed widget on my MacBook. I was looking at the listed widgets "for the fun of it" and clicked the "Daily Motivational" to download when the pop-up appeared. I actually called the number, suspicious that it would not be apple support and could tell it was not. Safari did not totally lock up and appears to be ok - for now.

Pop up problem solved, thank you. Called the number claiming to be Apple Tech Support and asked if they were indeed Apple Support. No response....hung up. Called back and told them to get a real job....they hung up😄.

We had a popup from "http://adsmaniasystemwar.online" telling us that our computer was "infected with an adware or malware causing you to see this popup" and telling us that our computer has been blocked. and "Virus System Alert" The scam phone number they gave was 0808 168 5196.

ok ... i am one of those people who "may have other tabs open that you do not want to lose."

i know enough about Safari to know that after relaunching it with your Shift key trick (which opens whatever you have designated as your Home Page), you can then get to an option in the History menu to "restore all windows from last session" (or something like that). so, when you gave me the idea of disconnecting from the internet, i thought i would be home free.

i would shift-launch, disconnect, restore all windows/tabs, and start closing the popups and invading tabs while they were unable to repopulate. unfortunately, even while disconnected from the internet (i unplugged my ethernet cable), the closing of the popup still triggered the opening of a new tab and new popup. ugh...

So, two questions:

1. Does this tell you that my hijacker is something more than a JavaScript popup, or that it is a virus in my system, or any other bad news (you know, since it is able to open new tabs even though i'm not online)? I think not but am interested in your opinion.

2. Will I lose all my other tabs by following your "None of this Worked" steps, namely, deleting .plists and .savedstate files? I think it will but am really hoping it won't.

Thank God for online help. The shift key worked on the second try! This is the second time this has happened. The site was " virus123". I will install the suggested fix. Thanks again, life back to normal.

Thank you so much for posting this! That was super scary. Something took over Safari and was there even after Forcing Quit and rebooting. I use Firefox for everything important, and only use Safari if I go onto FB, Twitter and sites that I'm unfamiliar with, always clearing it after every session and then closing it entirely. That was a scary reminder that there are creeps. So sad that some people with technical talent chose to use it for harm rather than good. Thank you again for posting helpful information. Fixing the bug was a huge relief. Have a good day!

Received the message you describe at www.madbubba.com. I used the Forced Quit method to resolve the issue on my mac. Thanks for posting. As a suggestion, add Scam Zapper to the apple store as I am weary of downloading any software outside of the Apple Store (even when the site, like this one, appears legit).

As ScamZapper is written in AppleScript, it does not meet Apple's user interface guidelines for submission to the App Store. It is at least signed with a Developer ID, which although does not absolutely prove legitimacy, it is a good indicator, as Apple can revoke certificates from someone who creates a malicious app. We are looking into at least getting the ScamZapper Safari extension into the Safari Extensions Gallery.

My daughter got a pop up on her iPhone (iOS 9 or later I think) similar to that, where it said to call the number and that her iPhone had been locked due to security reasons. It also said that she should not use her phone because data and information could be taken. Even if this is a scam (and it probably is) should I worry about whether or not they can take information from her phone? Also this appeared in the Google app but was addressed as a safari issue.

As with all pop-ups of this manner, the message is a lie. It's impossible for a webpage to collect a phone's data/files.

If you are having trouble closing out of the pop-up, double press the home button, and swipe upward on the screen showing the Google app. This will force it to close, and when it re-launches it should start fresh.

My daughter got a pop up on her iPhone (iOS 9 or later I think) similar to that, where it said to call the number and that her iPhone had been locked due to security reasons. It also said that she should not use her phone because data and information could be taken. Even if this is a scam (and it probably is) should I worry about whether or not they can take information from her phone? Also this appeared in the Google app but was addressed as a safari issue.

I can only guess that it is because your son does not visit any websites which redirect to these pop-ups. The next time you see one of the pop-ups, try to take note of what website you were visiting just before it. As a test, steer clear of that site for a while and see if you no longer encounter the pop-ups.

Hmmm... that's not good if it happens as soon as you open Safari. One other suggestion would be to open Safari, then go to Safari > Preferences > Privacy > Remove All Website Data. This will give Safari a fresh start.

This happened to me . I was the stupid one to call them. So I did , they said that one one was hacking me. They ask led me for a name , birthday and debt number. I only provided them with a birthday and a name but not the debt. I didn't let them access them my laptop either. But don't know , if I'm safe , cuz I have them my name and birthday. Help?

Since you did not let them access your laptop, you are probably safe. I would assume that they were asking for your personal information to try to gain access to your online accounts, or possibly commit identity theft, but I could be wrong. Even if that was their goal, I don't think you gave away enough information for them to do so.

This url launched in Safari in response to what was supposed to be an Ad link to Ebay. It went to a pop-up stating it was "From 'http://pmcertification.co/in' & claimed "Windows has detected some suspicious activity from your IP address. Some Spyware may have caused a security breach at your network location."

note: I'm not running Windows. This is pop up is in Safari under Mac OS X.

The ScamZapper extension is for Safari and is not compatible with Internet Explorer. Safari for Windows was deprecated after version 5.1.7 which is very old at this point, so unfortunately I do not think that ScamZapper would be a viable solution for you.

Thank you for your support. I was told by Apple when I asked about using virus protection or any other type of proctective software on the Windows side of my Mac, not too worry. They said with Mac the primary operating system any attack would be protected via it. I recently went on Internet Explorer, (a rare occurrence) because of an issue getting on a site with Safari. Within a couple of days I was hijacked, or so I thought with a pop up. It took a while to figure out what it was but once I read these come through your browser I found and downloaded the ScamZapper app. to Safari. Hence the reason for my original question. I wouldn't think simply running a Mac as I was told would automatically protectect I.E. Do you suggest I use a browser extension compatable with IE, if yes which one? Thanks again with any help.

I think there may have been some miscommunication when you talked to Apple. Running OS X will not protect your Windows environment, but perhaps they meant that any infection you get in Windows cannot "spread" to OS X. You are correct that installing ScamZapper in Safari will not protect Internet Explorer. Installing a browser extension for this problem in Internet Explorer would probably be a good idea, but anything IE-related would be out of our field of expertise so I do not know of any.

Thank you, I appreciate your follow up. I will go on the hunt for an
effective application for Internet Explorer asap. I'm concerned Apple
passed bad advice and will be getting Windows secured also. I've been
extremely lucky as I've had this set-up for 3yr. with only one incident!

It sounds like you have done just about everything that you need to do, though I also noticed that you mentioned that you divulged credit card information to the scammers. If so, a call to your bank is likely in order if you have not done so already.

I received the "you need to install the latest version of Flash Player" message pop up. This came from dllfilestab.com
After that I received the message that was inescapable that said that i needed to call the Technician in the 1800 737 481. The pop up read; System detected security error due to suspicious activity. Please Contact MAC technicions for help.

A coworker fell victim to this scam today. She actually called the number, but she hung up when they wouldn't tell her the name of the company (and from my urging once I realized what she was doing, as I had heard the audio from the scam pop-up windows earlier).

In her case, holding shift wouldn't work when restarting. However, disconnecting from the internet did the trick, and now we have you to thank!

For addition to your list above, the scam originated from:

livecustomer-support.com/message/securityalert.html

(still actively triggering the pop-ups at the time of this note).

The pop-up itself read:

Are you sure you want to leave this page?

MAC iOS Alert

This security update provides a fix for SSL connection verification. For information on the security content of this update and to unlock the MAC iOS please visit www.support.apple.com Or call 1-888-597-1473.

We received the popup from "apple.com-systemnotice.com" after visiting the tjmax website online that said our apple is infected by a virus and click ok to repair it. We turned off wifi on my Mac and managed to close the popup page. Luckily we did not click OK and decided to check online on another computer first and discovered this article. Not sure what would have happened if we clicked ok.

Hi, unfortunately none of this worked for me, even every step in the "None of This Worked!" section. Even after trying the disable WiFi trick, the pop-up came right back. And moving all of the suggested files to the trash didn't work either. It just kept coming back. Any other suggestions? Will downloading Scamzapper after the fact help, or does that only prevent new ones? Thanks.

Hi, encountered this one today indicating serious vulnerabilities have been found on the computer. Locked out of Safari. The URL was: sdvoll.com/systemprotection. Associated phone # 888.848.3877.

Deleted the files noted in your wonderful article, then installed ScamZapper (my dad's computer, and he's had this problem several times lately). Didn't realize he hasn't been updating, so running Mac OS 10.7.5 and Safari 6.1.6. He'll be getting upgraded this weekend. Thanks so much for such a great tool You saved me many hours of zapping, reinstalling, etc.

Hello, I fell for the Flash download scam and was stupid enough to give the scammer access to my computer by downloading Citrix Online Launcher.

I also provided my first name and then entered a support key the scammer provided. when the person gained access, she quickly showed me that my firewall is off and explained why it's important to turn it on. She also asked to have a minute to read the error message :( Soon after that I turned off the sharing access and disconnected my phone conversation. The process took about 5 minutes. So, I suspect something has already been done to my computer.

I am trying to delete citrix from computer but it's prompting for Support Key. Please advise and help! Thank you.

If you're going to have the Genius Bar at the Apple Store erase your drive, then you might as well just wait until then - there is no danger in leaving Citrix on your computer for the time being. Citrix is legitimate software, it's just that the people who were utilizing it were scammers. Once you erase the drive, Citrix will be removed along with everything else.

Great post. Mac is my favourite operating system. Somebody told me that ransomware virus is more prevalent now a days. You have given an awesome elaborated information. I used some best practices to prevent virus on my Mac here they are

Got a call from a client recently who suspected a virus attack. She is elderly and did make a call to the scammer but got suspicious and it ended at that. The web site with the popup was:

mac-device-detected-virus.info/index.html

It happened via a link in an email. There seems to be no seepage and I had no trouble closing the page and not having it automatically revisited. Thought this might help with your list of known scamming sites.

This is the nastiness that is causing problems for me. So far it keeps relaunching itself after I've done the above suggestions. Not sure if I'm doing anything wrong but I thought I'd at least get it out there.

OK, went back after and followed the ~/Library/ advice and that nailed the pop up. Now I'm getting what seems to be a legitimate pop up advising me that I MAY have junk on my Mac and would I like to clean it up. I guess keep on doing the Library trick until it goes away. BTW- this only happens on Safari. Not Firefox.

The pop-up is NOT legitimate at all. I'm guessing, based on the description, that the pop-up was prompting you to download MacKeeper, a well-known scam that will try to extort money out of you if installed. Advertisement pop-up windows like that are not related to the scams described in this article. In order to get rid of it, you either need to stop visiting the site that redirects to or displays the pop-up, or you should check to see if adware was installed.

My sister got the pop up and we called the number. We didn't know what was going on and gave him permission to use the computer thru the support.me thing. Once he had control he showed us thing that were wrong and said that it would be $140 to fix it. Once he said that I hung up and disconnected the control. We tried the "Shift+safari" buttons and it started working. Should we be paranoid about further harm from being done or are we safe? Thanks for your help

Okay so I had the same pop-up after clicking on a website to try wtch some movies online and it stopped me from accessing my safari and took me to my email saying this: IMG_0858.PNG

I'm using my phne when this all happened, so I was curious and called the number and this Indian guy asked for my phnes serial number to check wht the problem might have been, so I have it to him and he went ahead and said my phnes been compromised and there's no other way to fix the problem unless I pay $34.99 for this one time charge bc my "privacy" has expired and I had to pay again. From there it jst sounded off esp when I asked if I could call apple support and ask them about my problem he said no, they won't be able to help u with this problem. So I hung up. is my phne not safe anymore since I did give out my serial number?!!!!! Pls help me

Theoretically, the scammers could report your iPhone as stolen to the police. However, as these scammers are typically overseas, I do not think that it too likely. They could also register your iPhone to themselves if you did not already register it to you. Also, "free" movies online, aside from being a magnet for this kind of pop-up/redirect, are often illegal. If you avoid these sites in the future you should be able to avoid such pop-ups.

Go to http://supportprofile.apple.com, log in with your Apple ID, and check to see if it's already registered to you. If not, you will see an "Add Product" link below the last item in the list of your currently registered products.

Thank you for this helpful information. I made the dumb mistake of calling and giving them access to my Mac. I grew pretty suspicious and stopped sharing 15 minutes into it. The only thing I downloaded was the GoToAssist but nothing afterward. He tried to show me that my Mac was no longer supported by apple tech support then tried to show me that my firewall was off, then started to show me FireVault. That's when I stopped listening and thought it was a bunch of crap, unplugged my wifi and hung up on him. I have time capsule and will restore to before my Mac was compromised but wondering if I need to worry about any of my other devices that are connected to my wifi. My husband is paranoid that we might be vulnerable just by being turning wifi back on. Also what type of information could the get to besides what they see on my Mac when I share my computer? If I have usernames and passwords stored on my Mac on a password protected excel doc, could they get to that? This has been helpful.... Thanks again!

No other devices can be affected by this. For your Mac, if you are certain that the only thing downloaded was the GoToAssist remote access program, then they do not have access to anything on your Mac after you shut down the remote access. Restoring from the Time Machine backup should be all that you need to do.

I wasn't thinking when the fake alert popped up, which in 20 yrs of using Macs had never happened before. I called the number; the person had me go thru a legitimate 3rd party (citrix go-to-meeting) to utilize their support app. to share my screen with them. Luckily they were, it seems, terribly incompetent and just typed a short instruction into the Terminal app, told me the activities and processes going on indicated my computer had a virus or something -- they may have been leading up to "selling" me a program to fix the problem -- but my supervisor realized it was a scam and told me to disconnect -- how much damage could have been done from Terminal?

If you are not sure of exactly what they did, then you need to err on the side of caution and erase the drive. All of the information you need is in the "What if I Called the Number?" section of the article.

Thank u so much for your help. I was getting so frustrated whenever I would accidentally open safari (because i dont really use it) and there would be these BOGUS warnings!!!! I ended up having to do the last thing about the LastSession and it worked. Appreciate it.

just happened when i was going to apply for volunteer work at a place, i typed in the web and boom, loud ass buzzing noise and a web address with a toll-free call on it saying something like apple locks your computer due to virus related issue, forced quit browser and hard shutdown my computer and restarted, everything works great now.

thank you for the article, was wondering wtf just happened lol.

(went into my history and recovered full link) "DO NOT CLICK OR GO TO WEB LINK" browser lock hack: http://apple-update-security-error.info/*******

Thank you so much. Safari on my iPhone was stuck on a page to send an email to some unknown place. Every time I tried to cancel it, it would just circle back. Once I got out of Safari I deleted the history and the problem was fixed.

Thank you. I'd say you're a lifesaver but I don't know how serious the issue was. I clicked on a link and it generated an automatic email to foo@example.com. Whenever I deleted the draft it kept auto populating again.

Very helpful - got a full page, red screen, talking pop up which scared the crap out of me! When I called the phone #, my first two clues were that they never answered with a company name and they were there to fix Microsoft Adware. I went so far as to exit Safari and pull up the info on the website he provided. However, I clicked on info buttons while he was trying to get me to give personal info. When I asked him about the info about the company I found, he told me it was free and he was there to help me. When I told him I was going to call Apple, he hung up on me! I am going to use the info provided to fix/stop this nonsense - thank you!